﻿\section{Linux Memory Management}
Memory integrity checking is the main functionality considered in this project. Accessing the proper addresses of raw memory requires the knowledge of how the memory management features are implemented on the running Operating System. When Virtualization is used, the memory itself is virtualized making the memory management of a Virtualized system very much different to a conventional operating system.  Memory management under Xen virtualization will be the memory management technique dealt with in this project. But before looking into Xen's memory management we will look into conventional non virtualized memory management and thereafter will look into how Xen's memory management works.

The most frequently used architecture is x86 architecture and 32bit memory addressing therefore the project will focus only on X86 32bit memory management. To make the issues simpler, we will handle only non-PAE (Physical Address extension) memory.

\subsection{Memory Management on x86 32 systems}
Memory access in x86 32bit Linux systems have two levels of memory accessing, which are \emph{ virtual address space} and \emph{physical addresses} \cite{understandLinuxKernel}.

\begin{description}
	\item[Virtual address space] Uses a 32-bit unsigned integer that can be used to address up to 4GB. The Linux operating system divides memory into 2 parts. Upper 1 GB (0xc0000000 – 0xffffffff) is reserved for a kernel of operating system (this memory area can be accessed only when the CPU is switched into Kernel Mode). The remaining part of memory (3GB) is called User Land \cite{digitalForensics}.
	
	Virtual Address space is structured as a kernel segment plus a user segment. Code and data for the kernel can be accessed in the kernel segment, and code and data for the process in the user segment \cite{LinuxKernelInternal}. 

	\item[Physical Addresses]
	Physical addresses are used to address memory cells in memory chips. Physical addresses are represented as a 32-bit unsigned integer \cite{digitalForensics}.  They correspond to the electrical signals sent along the address pins of the microprocessor to the memory bus \cite{LinuxKernelInternal}. 

\end{description}

During the execution of a program in the processor virtual addresses need to be converted to physical addresses. Addresses are converted as mentioned below.



\begin{description}

	\item[Virtual address to Physical address conversion using paging]
	The standard way for the Linux OS to translate between virtual and physical addresses is to use paging. Paging enables the breaking down of a virtual address into sections, each representing an offset into a table that is a part of a different level of indirection. In the latest kernels there are four levels of indirection used in Linux systems. Page Global Directory (PGD), Page Upper Directory (PUD), Page Middle Directory (PMD) and page table entry (PTE). The way in which a address is converted using paging is illustrated in figure \ref{fig:paging}

	\begin{figure}
	\begin{center}
	\caption{Virtual addresses to physical addresses using Paging \label{fig:paging}}

	\ifpdf
		\includegraphics[width=5in]{images/paging.png}
	\fi
	\end{center}
	\end{figure}




	\item[Virtual to Physical memory conversion for kernel Addresses]
	The retrieval of physical addresses of kernel virtual addresses are generated as follows. This translation is accomplished by subtracting the constant PAGEOFFSET — hex value 0xC0000000 in x86 hardware from the virtual address. This means that the kernel virtual address 0xC1234567 is, in reality, physical address 0x01234567. The reason behind this conversion is that the virtual address space in the typical x86 machine is 4 GB and the topmost Gigabyte is assigned to the kernel \cite{linuxvm}. This upper Gigabyte begins at 0xC0000000. So physical memory begins at virtual address 0xC0000000, which is equivalent to physical memory address 0x00000000. This memory layout can be seen in figure \ref{fig:vmTranslate}

	\begin{figure}
	\begin{center}
	\caption{Mapping from Virtual addresses to physical addresses \label{fig:vmTranslate}}

	\ifpdf
		\includegraphics[width=5in]{images/vmTranslate.png}
	\fi
	\end{center}
	\end{figure}



	\item[Linear-mapped virtual addresses]

As mentioned above translation of virtual addresses to physical addresses need to be done through page tables. Yet the addresses to the page tables themselves need to be translated into physical addresses. There is a chicken and egg problem here and this problem is addressed through the linear-mapped virtual addresses.

The above mentioned address translation for kernel addresses is described in more detail below.

\begin{figure}
\begin{center}
\caption{Virtual Address Translation in more detail \label{fig:memoryTranslate}}

\ifpdf
    \includegraphics[width=5in]{images/memoryTranslate.png}
\fi
\end{center}
\begin{center}
{Shows the regions of memory and how each memory region is translated from virtual addresses to physical addresses. extracted from \cite{copilot} and reproduced}
\end{center}

\end{figure}


Figure \ref{fig:memoryTranslate} contains a diagram showing two kinds of virtual addresses and the relationship to physical addresses. Linux kernel reserves the virtual addresses above 0xc0000000 for kernel text and data structures \cite{understandLinuxKernel} \cite{linuxvm}. Virtual Addresses between 0xc0000000 and the point marked \emph{high memory} in the diagram are called linearly mapped addresses. The point \emph{high memory} is equal to the amount of physical memory available on the host therefore that point differs on different hosts with different amounts of memory. Linux kernel maps the linear-mapped addresses in a linear way to the physical addresses, and here the physical addresses can always be found by substracting the constant 0xc0000000 from the linear-mapped address. This linear mapping is showed by the arrow A in the figure. The kernel page tables, kernel text are some data structures that reside in this linear-mapped virtual memory region. Another important thing about this region is that data are stored in contiguous blocks.

The dynamically allocated data structures reside in the region of the region from \emph{high memory} to \emph{0xfe000000}. Page tables are used to translate the virtual addresses of this region to physical addresses. Large data structures spanning multiple pages can be stored in non-contiguous memory locations. 


\end{description}





 











\section{Memory Mapping in Virtualized Hosts}
A main difference of implementing a virtualized host from a conventional host is the way in which memory management happens. Under virtualization the memory needs to be virtualized, and then virtual memory regions should be created from the physical memory and allocated for each virtual host in such a way that the virtual host is not aware that it is accessing virtual memory.

Xen has used an indirection method in memory management to allow the creation of virtual memory regions from physical memory.

\subsection{Xen Memory}
Each VM as well as the Hypervisor needs to be allocated with physical memory. Xen traps the ownership and use of each page, allowing secure partitioning between domains\cite{xenInterface}.

Xen has a few memory types. These supports for fragmented physical address space. Below are the three levels of memory available in Xen. Figure \ref{fig:xenMemRedirection} illustrates these three levels.

\begin{figure}
\begin{center}
\caption{Three layers of Xen memory \label{fig:xenMemRedirection}. {Extracted from \cite{xenguide}}}

\ifpdf
    \includegraphics[width=5in]{images/xenMemRedirection.png}
\fi
\end{center}


\end{figure}


\begin{description}
\item[Machine Memory]
This is the physically available whole memory. The memory is represented as 4kb Machine page frames(MPF). This is the same across Xen and any Domain. These are the addresses used by the hardware.

\item[Pseudo-physical Memory]
This provides a per domain abstraction for memory. Allows sparsely allocated memory to appear as contiguous memory.
This acts as the physical addresses in a normal host, a virtual machine views these addresses as the physical address.

\item[Virtual Memory]
This is the same as the virtual memory used in normal hosts.

\end{description}

The mapping between machine page frames and physical page frames is done by globally readable 'machine-to-physical' tables.





\subsection{Implementations of Memory Mapping}
The main feature that should be implemented for the success of the secure applications over virtualization is the ability to monitor the memory of one VM from a different VM. There have been several approaches to achieve this.

XenAccess is an introspection Library for Xen. Using this it is possible to map memory of a different VM to Xen's Dom0. These mapping can be further implemented to create a custom made IDS which monitors a different VM. \cite{bryanSecureVM} 

AntFarm \cite{antfarm} is a approach where the memory of a VM is mapped to the VMM providing semantics. VMM is the systems primary resource manager therefore there is a possibility to provide some services to the VMs at the VMM level. Implementing such services at the VMM layer can be complicated by the lack of OS and application-level knowledge within a VMM. Antfarm describes techniques that can be used by a VMM to independently overcome part of the “semantic gap” separating it from the guest operating systems it supports.

There is a system that has provided the semantics of another VM and made existing IDSs and Virus scanners to scan another VM \cite{vmIntroSemantics}. This doesn't claim to be open source and would not provide the ability to examine how they have implemented the important parts of their system.



